Privacy Policy

• Account & contact data: name, email, mobile number, role, and organisation details.
• Health & clinical data: appointments, medical records, prescriptions, lab reports, vitals, and related information entered by providers or patients.
• Billing data: invoices and payment status. Payments are handled by third-party gateways; we do not store full card details.
• Usage & device data: log data, IP address, and interactions, used to operate and secure the Platform.

We use information to provide and maintain the Platform, deliver the features you request, process payments, secure and troubleshoot the service, comply with legal obligations, and communicate with you about your account. We do not sell your personal or health information.

Health information is sensitive personal data. We apply role-based access controls and strict tenant isolation so that users only see the records they are authorised to access. AI-assisted features process data solely to generate the requested output for authorised users and are not used to make automated decisions about care without clinician oversight.

We share information only as needed to run the service:

• Within your organisation, according to each user's role and permissions;
• With sub-processors who host and support the Platform (for example, cloud infrastructure and payment gateways), under contractual confidentiality and security obligations; and
• Where required by law, regulation, or valid legal process, or to protect the rights and safety of users.

We use technical and organisational safeguards including encryption in transit, encryption at rest for sensitive credentials and secrets, access controls, and audit logging. No system is perfectly secure, but we work to protect your data and to respond promptly to any incident in line with applicable law.

We retain personal and health information for as long as needed to provide the Platform and to meet legal, regulatory, and medical record-keeping requirements. When data is no longer required, we delete or anonymise it. Providers control retention of their patient records within the limits of applicable law.

Subject to applicable law, you may request access to, correction of, or deletion of your personal information, and may object to or restrict certain processing. Because providers control patient records, we may direct patient requests to the relevant provider. To exercise your rights, contact us using the details below.

Data may be processed and stored in data centres located in India or other jurisdictions where our infrastructure providers operate. Where data is transferred across borders, we take steps to ensure it remains protected consistent with this policy and applicable law.

Patient records for minors are created and managed by their provider or guardian. We do not knowingly allow minors to create their own accounts without appropriate consent.

We may update this Privacy Policy from time to time. When we make material changes, we will revise the effective date above and, where appropriate, provide additional notice.